~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/integrity/evm/evm_crypto.c

Version: ~ [ linux-5.13-rc5 ] ~ [ linux-5.12.9 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.42 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.124 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.193 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.235 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.271 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.271 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (C) 2005-2010 IBM Corporation
  3  *
  4  * Authors:
  5  * Mimi Zohar <zohar@us.ibm.com>
  6  * Kylene Hall <kjhall@us.ibm.com>
  7  *
  8  * This program is free software; you can redistribute it and/or modify
  9  * it under the terms of the GNU General Public License as published by
 10  * the Free Software Foundation, version 2 of the License.
 11  *
 12  * File: evm_crypto.c
 13  *       Using root's kernel master key (kmk), calculate the HMAC
 14  */
 15 
 16 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 17 
 18 #include <linux/module.h>
 19 #include <linux/crypto.h>
 20 #include <linux/xattr.h>
 21 #include <keys/encrypted-type.h>
 22 #include <crypto/hash.h>
 23 #include "evm.h"
 24 
 25 #define EVMKEY "evm-key"
 26 #define MAX_KEY_SIZE 128
 27 static unsigned char evmkey[MAX_KEY_SIZE];
 28 static int evmkey_len = MAX_KEY_SIZE;
 29 
 30 struct crypto_shash *hmac_tfm;
 31 struct crypto_shash *hash_tfm;
 32 
 33 static DEFINE_MUTEX(mutex);
 34 
 35 static struct shash_desc *init_desc(char type)
 36 {
 37         long rc;
 38         char *algo;
 39         struct crypto_shash **tfm;
 40         struct shash_desc *desc;
 41 
 42         if (type == EVM_XATTR_HMAC) {
 43                 tfm = &hmac_tfm;
 44                 algo = evm_hmac;
 45         } else {
 46                 tfm = &hash_tfm;
 47                 algo = evm_hash;
 48         }
 49 
 50         if (*tfm == NULL) {
 51                 mutex_lock(&mutex);
 52                 if (*tfm)
 53                         goto out;
 54                 *tfm = crypto_alloc_shash(algo, 0, CRYPTO_ALG_ASYNC);
 55                 if (IS_ERR(*tfm)) {
 56                         rc = PTR_ERR(*tfm);
 57                         pr_err("Can not allocate %s (reason: %ld)\n", algo, rc);
 58                         *tfm = NULL;
 59                         mutex_unlock(&mutex);
 60                         return ERR_PTR(rc);
 61                 }
 62                 if (type == EVM_XATTR_HMAC) {
 63                         rc = crypto_shash_setkey(*tfm, evmkey, evmkey_len);
 64                         if (rc) {
 65                                 crypto_free_shash(*tfm);
 66                                 *tfm = NULL;
 67                                 mutex_unlock(&mutex);
 68                                 return ERR_PTR(rc);
 69                         }
 70                 }
 71 out:
 72                 mutex_unlock(&mutex);
 73         }
 74 
 75         desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm),
 76                         GFP_KERNEL);
 77         if (!desc)
 78                 return ERR_PTR(-ENOMEM);
 79 
 80         desc->tfm = *tfm;
 81         desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
 82 
 83         rc = crypto_shash_init(desc);
 84         if (rc) {
 85                 kfree(desc);
 86                 return ERR_PTR(rc);
 87         }
 88         return desc;
 89 }
 90 
 91 /* Protect against 'cutting & pasting' security.evm xattr, include inode
 92  * specific info.
 93  *
 94  * (Additional directory/file metadata needs to be added for more complete
 95  * protection.)
 96  */
 97 static void hmac_add_misc(struct shash_desc *desc, struct inode *inode,
 98                           char *digest)
 99 {
100         struct h_misc {
101                 unsigned long ino;
102                 __u32 generation;
103                 uid_t uid;
104                 gid_t gid;
105                 umode_t mode;
106         } hmac_misc;
107 
108         memset(&hmac_misc, 0, sizeof(hmac_misc));
109         hmac_misc.ino = inode->i_ino;
110         hmac_misc.generation = inode->i_generation;
111         hmac_misc.uid = from_kuid(&init_user_ns, inode->i_uid);
112         hmac_misc.gid = from_kgid(&init_user_ns, inode->i_gid);
113         hmac_misc.mode = inode->i_mode;
114         crypto_shash_update(desc, (const u8 *)&hmac_misc, sizeof(hmac_misc));
115         if (evm_hmac_attrs & EVM_ATTR_FSUUID)
116                 crypto_shash_update(desc, inode->i_sb->s_uuid,
117                                     sizeof(inode->i_sb->s_uuid));
118         crypto_shash_final(desc, digest);
119 }
120 
121 /*
122  * Calculate the HMAC value across the set of protected security xattrs.
123  *
124  * Instead of retrieving the requested xattr, for performance, calculate
125  * the hmac using the requested xattr value. Don't alloc/free memory for
126  * each xattr, but attempt to re-use the previously allocated memory.
127  */
128 static int evm_calc_hmac_or_hash(struct dentry *dentry,
129                                 const char *req_xattr_name,
130                                 const char *req_xattr_value,
131                                 size_t req_xattr_value_len,
132                                 char type, char *digest)
133 {
134         struct inode *inode = dentry->d_inode;
135         struct shash_desc *desc;
136         char **xattrname;
137         size_t xattr_size = 0;
138         char *xattr_value = NULL;
139         int error;
140         int size;
141 
142         if (!inode->i_op->getxattr)
143                 return -EOPNOTSUPP;
144         desc = init_desc(type);
145         if (IS_ERR(desc))
146                 return PTR_ERR(desc);
147 
148         error = -ENODATA;
149         for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
150                 if ((req_xattr_name && req_xattr_value)
151                     && !strcmp(*xattrname, req_xattr_name)) {
152                         error = 0;
153                         crypto_shash_update(desc, (const u8 *)req_xattr_value,
154                                              req_xattr_value_len);
155                         continue;
156                 }
157                 size = vfs_getxattr_alloc(dentry, *xattrname,
158                                           &xattr_value, xattr_size, GFP_NOFS);
159                 if (size == -ENOMEM) {
160                         error = -ENOMEM;
161                         goto out;
162                 }
163                 if (size < 0)
164                         continue;
165 
166                 error = 0;
167                 xattr_size = size;
168                 crypto_shash_update(desc, (const u8 *)xattr_value, xattr_size);
169         }
170         hmac_add_misc(desc, inode, digest);
171 
172 out:
173         kfree(xattr_value);
174         kfree(desc);
175         return error;
176 }
177 
178 int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name,
179                   const char *req_xattr_value, size_t req_xattr_value_len,
180                   char *digest)
181 {
182         return evm_calc_hmac_or_hash(dentry, req_xattr_name, req_xattr_value,
183                                 req_xattr_value_len, EVM_XATTR_HMAC, digest);
184 }
185 
186 int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name,
187                   const char *req_xattr_value, size_t req_xattr_value_len,
188                   char *digest)
189 {
190         return evm_calc_hmac_or_hash(dentry, req_xattr_name, req_xattr_value,
191                                 req_xattr_value_len, IMA_XATTR_DIGEST, digest);
192 }
193 
194 /*
195  * Calculate the hmac and update security.evm xattr
196  *
197  * Expects to be called with i_mutex locked.
198  */
199 int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name,
200                         const char *xattr_value, size_t xattr_value_len)
201 {
202         struct inode *inode = dentry->d_inode;
203         struct evm_ima_xattr_data xattr_data;
204         int rc = 0;
205 
206         rc = evm_calc_hmac(dentry, xattr_name, xattr_value,
207                            xattr_value_len, xattr_data.digest);
208         if (rc == 0) {
209                 xattr_data.type = EVM_XATTR_HMAC;
210                 rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_EVM,
211                                            &xattr_data,
212                                            sizeof(xattr_data), 0);
213         } else if (rc == -ENODATA && inode->i_op->removexattr) {
214                 rc = inode->i_op->removexattr(dentry, XATTR_NAME_EVM);
215         }
216         return rc;
217 }
218 
219 int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr,
220                   char *hmac_val)
221 {
222         struct shash_desc *desc;
223 
224         desc = init_desc(EVM_XATTR_HMAC);
225         if (IS_ERR(desc)) {
226                 pr_info("init_desc failed\n");
227                 return PTR_ERR(desc);
228         }
229 
230         crypto_shash_update(desc, lsm_xattr->value, lsm_xattr->value_len);
231         hmac_add_misc(desc, inode, hmac_val);
232         kfree(desc);
233         return 0;
234 }
235 
236 /*
237  * Get the key from the TPM for the SHA1-HMAC
238  */
239 int evm_init_key(void)
240 {
241         struct key *evm_key;
242         struct encrypted_key_payload *ekp;
243         int rc = 0;
244 
245         evm_key = request_key(&key_type_encrypted, EVMKEY, NULL);
246         if (IS_ERR(evm_key))
247                 return -ENOENT;
248 
249         down_read(&evm_key->sem);
250         ekp = evm_key->payload.data;
251         if (ekp->decrypted_datalen > MAX_KEY_SIZE) {
252                 rc = -EINVAL;
253                 goto out;
254         }
255         memcpy(evmkey, ekp->decrypted_data, ekp->decrypted_datalen);
256 out:
257         /* burn the original key contents */
258         memset(ekp->decrypted_data, 0, ekp->decrypted_datalen);
259         up_read(&evm_key->sem);
260         key_put(evm_key);
261         return rc;
262 }
263 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp